[Proposal] Carry the service identity that executes an action #458

Checked on integration at d09e1bd.

ACS carries the human principal (user_identity at sessionStart), the agent (metadata.agent_id on every request), and the session (metadata.session_id). It has no field for the service identity, meaning the service account or workload credential the agent uses when a tool call runs. Concepts › Identity names the Observed Agent, Guardian, and policy-author identities and does not mention it.

Without that field, a Guardian cannot write a policy keyed on which credential an action will run under, and an audit record cannot say which service account acted.

The ACS mapping against AARM (issue #213) found that AARM R6 requires binding each action to a service identity, so this gap blocks an ACS deployment from meeting AARM Core.

Done when a request can carry the executing service identity as an identity descriptor in the same type-discriminated form the Identity concept already defines, and the concept page lists it.